Executive brief
Ninja Forms is a popular WordPress plugin for building contact forms. The plugin contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. When users visit pages containing the injected script, it executes in their browsers, potentially allowing attackers to steal credentials, deface content, or compromise website visitors.
Technical details
The vulnerability exists in Ninja Forms versions up to 3.15.1 due to insufficient input sanitization and output escaping of the Repeater Child 'type' parameter. An attacker exploits a type confusion in unmatched array keys to inject arbitrary HTML/JavaScript. The attack requires the Ninja Forms File Uploads add-on to be active, as the attacker routes an unwhitelisted child entry through the File Uploads handler to write attacker-supplied HTML files containing arbitrary JavaScript to web-server-writable directories such as the site root. The malicious file is then served from the site's own origin, executing within the security context of the vulnerable site. The vulnerability is unauthenticated and requires no user interaction beyond a victim visiting an affected page. Patches are available in versions after 3.15.1.
Affected products
- Ninja Forms Ninja Forms – The Contact Form Builder That Grows With You up to and including 3.15.1
Timeline
- 2026-09-05: disclosed